Security audit
Security checks for vulnerabilities and agentic risk
This is a Git instruction skill with expected history-rewriting and recovery commands, but it should be used carefully because some examples can discard local work or rewrite remote branch history.
Install only if you want advanced Git workflow help. Before following examples involving git reset --hard, force-with-lease pushes, rebases, or branch cleanup, confirm the branch is yours to rewrite, check git status, and create a backup branch or stash if there is uncommitted work.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
git push --force-with-lease origin feature/user-auth
### Workflow 2: Apply Hotfix to Multiple Releases
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Accidentally reset to wrong commit
git reset --hard HEAD~5 # Oh no!
# Use reflog to find lost commits
git reflog
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Accidentally reset to wrong commit
git reset --hard HEAD~5 # Oh no!
# Use reflog to find lost commits
git reflog
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Accidentally reset to wrong commit
git reset --hard HEAD~5 # Oh no!
# Use reflog to find lost commits
git reflog
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Accidentally reset to wrong commit
git reset --hard HEAD~5 # Oh no!
# Use reflog to find lost commits
git reflog
The force-push example uses git push --force-with-lease, which is safer than --force but still rewrites remote history and can disrupt collaborators if used on shared branches. The surrounding note is informal and not a clear warning about coordination, branch ownership, and the consequences to others pulling the branch.
The skill shows multiple destructive git reset --hard recovery examples without an explicit warning that uncommitted local changes will be permanently discarded. In an instructional skill, users may copy commands directly, so omission of safety guidance increases the chance of accidental data loss even though the commands are legitimate Git operations.
No suspicious patterns detected.